Since 2010, legal entities have been criminally liable in Spain. An effective prevention model can avoid conviction, but only if it is real and not made of paper.
Since the 2010 reform introduced the criminal liability of legal entities, and especially since the 2015 reform regulated organisation and management models, criminal compliance has ceased to be an Anglo-Saxon fashion and has become a matter of corporate survival. A company can be sentenced to multi-million fines, suspension of activities and even dissolution. And it can also be exempted from liability if it proves that it had an effective compliance programme. We explain how this system works and what the case law requires.
When a company is criminally liable
Article 31 bis of the Criminal Code establishes two routes of attribution. The first: offences committed in the name or on behalf of the company, and for its direct or indirect benefit, by its legal representatives or executives with powers of organisation and control. The second: offences committed by employees subject to the authority of the former, where the act was made possible by a serious breach of the duties of supervision, oversight and control. Not all offences give rise to corporate liability: only those the Code expressly provides for, including fraud, money laundering, offences against the Public Treasury, corruption in business, environmental offences and the discovery of secrets.
The exemption: the requirements of the prevention model
The company is exempt from liability if it proves that, before the offence was committed, it had adopted and effectively implemented an organisation and management model suitable for preventing offences of the nature of the one committed. The Code requires that model to identify the risk activities (the so-called criminal risk map), establish protocols for the formation of intent and decision-making, have adequate financial resource management models, impose the obligation to report risks and breaches through a whistleblowing channel, provide for a disciplinary system and contemplate the periodic verification and updating of the model itself. In addition, supervision must be entrusted to a body with autonomous powers, the compliance officer or compliance body, except in small companies, where the management body itself may assume it.
Key points: the programme must pre-date the offence and be genuinely implemented; the whistleblowing channel is mandatory and Law 2/2023 reinforces the protection of the whistleblower; and paper programmes not only do not exempt, they can actually be harmful.
What the case law demands: a culture of compliance
The Supreme Court has insisted, since its first judgments on the matter, that what is decisive is not the formal existence of a manual, but proof of a genuine culture of compliance: that the company is organised to detect and react to crime, and not simply decorated with documents. In forensic practice, this means the programme must be able to display evidence: minutes of the compliance body, records of staff training, internal investigations actually conducted, disciplinary sanctions imposed, reviews after incidents. A programme bought as a template and kept in a drawer will hardly withstand judicial scrutiny, and may even show that the company knew its risks and did nothing.
Practical effects: exemption, mitigation and procedural strategy
If the model met the requirements but had minor deficiencies, or was adopted after the offence though before trial, liability is mitigated. Confession, cooperation with the investigation, reparation of the damage and the establishment of effective measures to prevent future offences also mitigate. In criminal proceedings against the company, the compliance programme becomes the central piece of the corporate defence, which is autonomous and may differ from the defence of the accused executives: the interests of the legal entity and those of the individuals do not always coincide, and choosing separate defences is often indispensable.
Conclusion
Criminal compliance is today the frontier between an isolated incident involving an employee and a corporate conviction with devastating consequences. Implementing a model adapted to the real risk of the activity, resourcing it and generating evidence of its operation is the best defensive investment a company can make, whatever its size. This article is for information purposes and does not replace professional advice on a specific case.
Related: criminal compliance, corporate criminal liability and the five questions a judge asks about your compliance programme.
undefined
Frequently asked questions
When is a company criminally liable in Spain?
Under Article 31 bis of the Criminal Code, for offences committed in its name or on its behalf and for its direct or indirect benefit by its legal representatives or executives with powers of organisation and control, and for offences committed by employees under their authority where the act was made possible by a serious breach of the duties of supervision, oversight and control. Only the offences expressly listed in the Code give rise to corporate liability.
What must a compliance programme contain to exempt the company?
It must pre-date the offence and be effectively implemented, identify the risk activities (criminal risk map), establish protocols for decision-making, provide adequate financial resource management, impose a whistleblowing channel, provide for a disciplinary system and periodic review and updating, and be supervised by a body with autonomous powers, except in small companies where the management body may assume it.
What does the Supreme Court require from a compliance programme?
Proof of a genuine culture of compliance rather than the formal existence of a manual: minutes of the compliance body, staff training records, internal investigations actually conducted, disciplinary sanctions imposed and reviews after incidents. A template programme kept in a drawer will hardly withstand judicial scrutiny.
Can an imperfect compliance programme still help the company?
Yes. If the model met the requirements with minor deficiencies, or was adopted after the offence but before trial, liability is mitigated. Confession, cooperation with the investigation, reparation of the damage and effective preventive measures also mitigate.
Francisco Javier Martín Porras
Abogado penalista, socio de Société de Conseil Juridique et Expert y creador de la metodología LIWARD®. Dirige la defensa en procedimientos penales de alta complejidad, combinando estrategia procesal con análisis pericial y forense. Conozca al equipo →
